CVE-2026-33731: AVideo Authorize.Net Webhook Signature Bypass Vulnerability
Summary
CVE-2026-33731: The Authorize.Net webhook handler at plugin/AuthorizeNet/webhook.php contains a signature verification bypass that allows an attacker to forge webhook requests with arbitrary payment amounts and target user IDs. Affects wwbn/avideo versions < 29.0. Fixed in 29.0. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
AVideo is an open-source video streaming platform that allows users to upload, share, and monetize video content. It integrates with payment gateways like Authorize.Net to facilitate transactions. This vulnerability arises from flaws in the webhook handling process, which can be exploited to manipulate wallet balances without legitimate payments.
Vulnerability Detail
The vulnerability in AVideo stems from a signature verification bypass in the Authorize.Net webhook handler. Attackers can forge webhook requests with arbitrary payment amounts and target user IDs by exploiting three key flaws: (1) an OR logic flaw in signature validation, (2) payload values overriding API-fetched values, and (3) a lack of approval checks before processing payments. This allows attackers to inflate wallet balances, access premium content fraudulently, and activate subscriptions without actual payments, leading to significant financial loss for platform owners.
How To Fix
Minimum fixed version
29.0
This is the first release that contains the fix.
composer require wwbn/avideo:29.0Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, disable the Authorize.Net webhook functionality until the patch is applied. This can prevent unauthorized transactions until a proper fix is implemented.
Conclusion
The CVE-2026-33731 vulnerability in AVideo poses significant risks by allowing attackers to manipulate wallet balances through forged webhook requests. It is crucial for users to update to the latest version and apply the recommended fixes to safeguard their installations.
See every vulnerability recorded for wwbn/avideo →
FAQ
CVE-2026-33731 is a vulnerability in AVideo that allows attackers to bypass signature verification in Authorize.Net webhooks, enabling them to inflate wallet balances fraudulently.
You can check if your application is affected by using Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to analyze your composer.lock file.
The consequences include unauthorized wallet balance inflation, fraudulent access to premium content, and potential financial losses for the platform owner.
To secure your AVideo installation, update to version 29.0 or later and implement the recommended code fixes to address the vulnerability.
Yes, you can temporarily disable the Authorize.Net webhook functionality to prevent unauthorized transactions until the patch is applied.
References
Related vulnerabilities
Recent vulnerabilities recorded for wwbn/avideo.
